Home / server / Questions / 773768
Accepted
John
Asked: 2016-04-29 21:17:54 +0800 CST

How does iptables --hitcount collect its values

  • 772

Im looking at SSH bruteforce prevention with iptables recent module.

I would like to know how does the --hitcount collect the value that it will use? Is it bytes, packets, no. of conntracked items or something else?

thanks!

Jonathan

iptables

1 Answers

  1. Best Answer

    --rcheck --hitcount checks the value of an internal counter which is incremented by one for each hit on a -m recent --set (or --update) rule of the same --name. Rules are evaluated in the context of packets, so the number of packets is the tracked quantity. This from the man page for iptables on my CentOS 6 system:

       --hitcount hits

    [...] When used, this will narrow the match to only happen when the address is in the list and packets had been received greater than or equal to the given value.

    • 4